[MB-63527] XDCR - Show target eaccess errors on UI screen

Product: Couchbase Server
Component: XDCR
Issue Link: MB-63527
Affects Versions: 7.2.x, 7.6.x
Fix Versions: 7.2.7, 7.6.4, 8.0.0

Summary

• When a remote cluster reference user does not have sufficient privileges on the target cluster (specifically lacking the XDCR Inbound[ role|https://docs.couchbase.com/server/7.6/learn/security/roles.html#xdcr-inbound]), XDCR replication can fail with EACCESS errors.
• Although these errors are captured in Prometheus metrics and logs, they were not previously surfaced on the Couchbase UI, leading to ambiguity when replication appeared “stuck” with items remaining but no visible UI error.

Symptoms 

• XDCR replication shows items remaining count stuck on the XDCR dashboard.
• No specific error message is displayed on the UI.
• The following error may appear in logs or Prometheus metrics:

  Following number of mutations are rejected by target due to non-temporary error responses:
  (response errCode: 24 errName: EACCESS errDesc: Not authorized for command)

• Prometheus metric xdcr_target_eaccess_total shows non-zero counts, for example:

  xdcr_target_eaccess_total{sourceBucketName="B1", targetBucketName="B2", pipelineType="Main"} 4651

Triggers

• The remote cluster reference user used for XDCR does not have the required privileges on the target cluster.
• Most commonly, the user is missing the XDCR Inbound role on the target cluster bucket.
• Attempting to replicate from Source to Target under these conditions results in target rejections with EACCESS.

Verification

To confirm the issue is related to insufficient privileges:

1. Check the XDCR replication logs for EACCESS or Not authorized for command messages.
2. Review metric xdcr_target_eaccess_total for non-zero counters.
3. Inspect the user roles for the remote cluster reference user on the target cluster — confirm if the XDCR Inbound role is missing.
4. Observe that replication remains stuck with items remaining in the UI, without any visible error banner.

Workarounds

• Workaround:
  Assign the XDCR Inbound role to the remote cluster reference user on the target cluster bucket. This allows the target to accept replication mutations.
• Fix:
  A product enhancement now displays EACCESS error alerts directly on the XDCR UI dashboard, providing immediate visibility into privilege-related replication failures. This fix is included in Couchbase Server 7.2.7+, 7.6.4+, and 8.0.0+.